details: http://hg.nginx.org/nginx/rev/595b179e429f branches: changeset: 6206:595b179e429f user: Maxim Dounin <mdou...@mdounin.ru> date: Tue Jul 14 01:10:25 2015 +0300 description: OCSP stapling: fixed segfault without nextUpdate.
OCSP responses may contain no nextUpdate. As per RFC 6960, this means that nextUpdate checks should be bypassed. Handle this gracefully by using NGX_MAX_TIME_T_VALUE as "valid" in such a case. The problem was introduced by 6893a1007a7c (1.9.2). Reported by Matthew Baldwin. diffstat: src/event/ngx_event_openssl_stapling.c | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-) diffs (25 lines): diff --git a/src/event/ngx_event_openssl_stapling.c b/src/event/ngx_event_openssl_stapling.c --- a/src/event/ngx_event_openssl_stapling.c +++ b/src/event/ngx_event_openssl_stapling.c @@ -637,11 +637,16 @@ ngx_ssl_stapling_ocsp_handler(ngx_ssl_oc goto error; } - valid = ngx_ssl_stapling_time(nextupdate); - if (valid == (time_t) NGX_ERROR) { - ngx_log_error(NGX_LOG_ERR, ctx->log, 0, - "invalid nextUpdate time in certificate status"); - goto error; + if (nextupdate) { + valid = ngx_ssl_stapling_time(nextupdate); + if (valid == (time_t) NGX_ERROR) { + ngx_log_error(NGX_LOG_ERR, ctx->log, 0, + "invalid nextUpdate time in certificate status"); + goto error; + } + + } else { + valid = NGX_MAX_TIME_T_VALUE; } OCSP_CERTID_free(id); _______________________________________________ nginx-devel mailing list nginx-devel@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx-devel